Sekai’s Bank - Signature#

Let me introduce you to Sekai Bank!

Static Analysis using Jadx#

I started analyze apk file using Jadx GUI. I loaded the apk file and started exploring the code.

1
package com.sekai.bank;
2

3
import android.app.Application;
4
import com.sekai.bank.network.ApiClient;
5
import com.sekai.bank.utils.TokenManager;
6
import com.sekai.bank.utils.delayed_transaction.DelayedTransactionManager;
7

8
/* loaded from: classes2.dex */
9
public class SekaiApplication extends Application {
10
    private static SekaiApplication instance;
11
    private ApiClient apiClient;
12
    private TokenManager tokenManager;
13

14
    @Override // android.app.Application
15
    public void onCreate() {
16
        super.onCreate();
17
        instance = this;
18
        this.tokenManager = new TokenManager(this);
19
        this.apiClient = new ApiClient(this.tokenManager);
20
        initializeDelayedTransactionMonitoring();
21
    }
22

23
    private void initializeDelayedTransactionMonitoring() {
24
        new DelayedTransactionManager(this).startPeriodicChecking();
25
    }
26

27
    public static SekaiApplication getInstance() {
28
        return instance;
29
    }
30

31
    public ApiClient getApiClient() {
32
        return this.apiClient;
33
    }
34

35
    public TokenManager getTokenManager() {
36
        return this.tokenManager;
37
    }
38
}

From the SekaiApplication class, see that it initializes several components for the application, including the

ApiClient
TokenManager
DelayedTransactionManager

Navigated to the ApiClient and get important information about baseURL:

1
public class ApiClient {
2
    private static final String BASE_URL = "https://sekaibank-api.chals.sekai.team/api/";
3
    private static final int REFRESH_TIMEOUT_SECONDS = 3;
4
    private static final String TAG = "SekaiBank-API";
5
    private static final int TIMEOUT_SECONDS = 30;
6
    private static final int TOKEN_TIMEOUT_SECONDS = 2;
7
    private final ApiService apiService;
8
    private final Retrofit retrofit;
9
    private final TokenManager tokenManager;

And all endpoints:

1
public interface ApiService {
2
    @PUT("auth/pin/change")
3
    Call<ApiResponse<Void>> changePin(@Body PinRequest pinRequest);
4

5
    @GET("user/search/{username}")
6
    Call<ApiResponse<User>> findUserByUsername(@Path("username") String str);
7

8
    @GET("user/balance")
9
    Call<ApiResponse<BalanceResponse>> getBalance();
10

11
    @POST("flag")
12
    Call<String> getFlag(@Body FlagRequest flagRequest);

Looking into the FlagRequest class:

1
public class FlagRequest {
2
    private boolean unmask_flag;
3

4
    public FlagRequest(boolean z) {
5
        this.unmask_flag = z;
6
    }
7

8
    public boolean getUnmaskFlag() {
9
        return this.unmask_flag;
10
    }
11

12
    public void setUnmaskFlag(boolean z) {
13
        this.unmask_flag = z;
14
    }
15
}

So we have to add unmask_flag to the request body, then craft a request to this endpoint with the appropriate payload to retrieve the flag.

Break down the request#

Trying to send the request to /flag endpoint:

1
curl -X POST https://sekai-bank.ctf/api/flag -H "Content-Type: application/json"

Got response: X-Signature is missing. Looking into how requests are handled, I found this class:

1
private class SignatureInterceptor implements Interceptor {
2
    ...
3
    @Override
4
    public Response intercept(Interceptor.Chain chain) throws IOException {
5
        Request request = chain.request();
6
        try {
7
            return chain.proceed(request.newBuilder().header("X-Signature", generateSignature(request)).build());
8
        } catch (Exception e) {
9
            Log.e(ApiClient.TAG, "Failed to generate signature: " + e.getMessage());
10
            return chain.proceed(request);
11
        }
12
    }

From here, X-Signature is generated using HMAC-SHA256, with:

The request body
The app’s signing certificate

as inputs. This value is placed in the header.

Get App Signature#

1
apksigner verify --print-certs SekaiBank.apk
2
Signer #1 certificate DN: C=ID, ST=Bali, L=Indonesia, O=HYPERHUG, OU=Development, CN=Aimar S. Adhitya
3
Signer #1 certificate SHA-256 digest: 3f3cf8830acc96530d5564317fe480ab581dfc55ec8fe55e67dddbe1fdb605be
4
Signer #1 certificate SHA-1 digest: 2c9760ee9615adabdee0e228aed91e3d4ebdebdf
5
Signer #1 certificate MD5 digest: fcab4af1f7411b4ba70ec2fa915dee8e

From the generateSignature method, SHA256 is used:

1
if (signingCertificateHistory != null && signingCertificateHistory.length > 0) {
2
    MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
3
    for (Signature signature : signingCertificateHistory) {
4
        messageDigest.update(signature.toByteArray());
5
    }

Crafting X-Signature Header#

The string used in HMAC is:

1
String str = request.method() + "/api".concat(getEndpointPath(request)) + getRequestBodyAsString(request);

So for our case: POST/api/flag{"unmask_flag":true}

Python script to generate the signature:

1
import hmac, hashlib
2
key_hex = "3f3cf8830acc96530d5564317fe480ab581dfc55ec8fe55e67dddbe1fdb605be"  # from apksigner
3
key = bytes.fromhex(key_hex)
4
msg = b'POST/api/flag{"unmask_flag":true}'
5
print(hmac.new(key, msg, hashlib.sha256).hexdigest())

Output:

1
440ba2925730d137259f297fd6fba02af2f7b6c414dd16a1ac336e9047cdb8f5

Now final request:

1
curl -X POST "https://sekaibank-api.chals.sekai.team/api/flag" \
2
  -H "Content-Type: application/json" \
3
  -H "X-Signature: 440ba2925730d137259f297fd6fba02af2f7b6c414dd16a1ac336e9047cdb8f5" \
4
  -d '{"unmask_flag":true}'

And the flag is retrieved successfully.